Is CVE-2026-108826 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108826 being exploited in the wild.

How severe is CVE-2026-108826?

High severity, with a CVSS score of 7.3, published 12 October 2026.

Is there a fix for CVE-2026-108826?

Yes: fixed in Fixed in commit 557154f4fa025f51553094f47b06aa024220c48f (Zen Cart version after 2.2.2). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108826 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-108826?

Check whether you run Zen Cart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108826: Zen Cart SQL injection in PayPal IPN handler

CVE-2026-108826 · Severity: high · CVSS 7.3 · Published 2026-10-12

Zen Cart, an e-commerce platform that manages online stores, contains an unauthenticated SQL injection vulnerability in its PayPal payment processing module. An attacker can exploit this without authentication to read sensitive database information like customer data and administrator credentials, or modify transaction records to cause financial fraud.

Technologies: Zen Cart. Vendors: Zen Cart.

Quick answers

Is CVE-2026-108826 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108826 being exploited in the wild.
How severe is CVE-2026-108826?: High severity, with a CVSS score of 7.3, published 12 October 2026.
Which products and versions are affected?: Zen Cart up to 2.2.2.
Is there a fix for CVE-2026-108826?: Yes: fixed in Fixed in commit 557154f4fa025f51553094f47b06aa024220c48f (Zen Cart version after 2.2.2). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108826 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-108826?: Check whether you run Zen Cart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Fixed in commit 557154f4fa025f51553094f47b06aa024220c48f (Zen Cart version after 2.2.2)

Technical details

The PayPal IPN handler in ipn_main_handler.php concatenates unsanitized user-supplied txn_id POST parameter directly into the WHERE clause of a SQL UPDATE statement within zen_db_perform(). An unauthenticated remote attacker can bypass IPN validation by prefixing the custom parameter with EC-, DP-, or WPP- and then inject arbitrary SQL commands via txn_id. The vulnerability allows reading arbitrary data and modifying PayPal transaction records.

Affected products

Zen Cart Zen Cart up to 2.2.2

Timeline

2026-10-12: disclosed
2026-10-12: exploited: Exploit made public

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.